Cyber Threats Targeting Australia and New Zealand Fueled by Initial Access Sales, and Ransomware Campaigns
Throughout 2025, the cybersecurity landscape in Australia and New Zealand has seen a significant increase in sophisticated attacks focused on the sale of compromised network access. According to Cyble Research and Intelligence Labs, there were 92…
Throughout 2025, the cybersecurity landscape in Australia and New Zealand has seen a significant increase in sophisticated attacks focused on the sale of compromised network access. According to Cyble Research and Intelligence Labs, there were 92 documented instances of such sales affecting organizations in these regions, highlighting an advanced underground marketplace where stolen credentials and network entry points are openly traded.
Data-rich industries have been disproportionately impacted, with threat actors targeting sectors with high-value data, such as retail, banking, financial services, insurance, professional services, and healthcare. Retail organizations, in particular, were the primary targets, accounting for 34% of initial access sales incidents. The BFSI sector followed with nine cases, and professional services firms saw seven documented incidents.
Understanding Access Brokerage Market Structure and Attack Patterns
The initial access marketplace is characterized by a fragmented ecosystem, not dominated by a few actors. The threat actor known as cosmodrome emerged as the leading seller of compromised access during the reporting period, followed by another actor under the alias shopify. However, these sellers accounted for only 26% of total observed listings, with other activities arising from numerous participants on forums such as Exploit and Darkforums.
Retail organizations, in particular, were the primary targets, accounting for 34% of initial access sales incidents.
In June 2025, the threat group Scattered Spider conducted a significant attack on a major Australian airline, compromising a customer service portal and exposing data of nearly six million customers. Earlier, in March, the actor Stari4ok advertised access to a large Australian retail chain, offering 250 gigabytes of data for USD 1,500.
This decentralized marketplace indicates that initial access sales have become a viable revenue stream for various threat actors, enhancing the scale and resilience of the underground economy and increasing cyber risks for organizations in Australia and New Zealand in 2026.
Based on reporting by Cyber Security News.